[logs] Debian: Add Journal support and stop full tarball of /var/log

These changes are only on the Debian/Ubuntu bit of logs

Persistent systemd journaling (/var/log/journal exists)
 use that instead of collecting any kern/syslog/auth from /var/log.
 We also implement a log_days similar to the RH bit, but we default
 to 7 days instead of 3.
 --all-logs removes the day limit and gets it all

Rsyslog style (assumed if /var/log/journal doesn't exist
 default run: collect all 4 of syslog[.1] and kern.log[.1]
 (Same as previous behavior plus auth.log).
 --all-logs: collect syslog*, kern.log*, and auth.log*

The notable change for --all-logs is it used to just collect all of
/var/log which causes MANY issues.

Before this change using --all-logs on systems with persistent journal
we would collect duplicate log files as such:
 * Collect all of syslog*/kern*/auth*
 * Collect the entire journal via /var/log/journal
 * Collect the last two boots of journal via running journalctl command

Even with this change we still collect the journal last/current boot
with whatever is copied by journal since log_days.

Resolves: #1519

Signed-off-by: Bryan Quigley <bryan.quigley@canonical.com>
Signed-off-by: Bryn M. Reeves <bmr@redhat.com>

1 files changed, 34 insertions, 12 deletions

diff --git a/sos/plugins/logs.py b/sos/plugins/logs.py
index 66fbaebe..dec01f3a 100644
--- a/sos/plugins/logs.py
+++ b/sos/plugins/logs.py
@@ -104,21 +104,43 @@ class RedHatLogs(Logs, RedHatPlugin):
 
 class DebianLogs(Logs, DebianPlugin, UbuntuPlugin):
 
+    option_list = [
+        ("log_days", "the number of days logs to collect", "", 7)
+    ]
+
     def setup(self):
         super(DebianLogs, self).setup()
-        if not self.get_option("all_logs"):
-            self.add_copy_spec([
-                "/var/log/syslog",
-                "/var/log/syslog.1",
-                "/var/log/kern.log",
-                "/var/log/kern.log.1",
-                "/var/log/udev",
-                "/var/log/dist-upgrade",
-                "/var/log/installer",
-                "/var/log/unattended-upgrades"
+        days = int(self.get_option("log_days"))
+        journal = os.path.exists("/var/log/journal/")
+        self.add_copy_spec([
+            "/var/log/udev",
+            "/var/log/dist-upgrade",
+            "/var/log/installer",
+            "/var/log/unattended-upgrades"
             ])
-            self.add_cmd_output('ls -alRh /var/log/')
+        self.add_cmd_output('ls -alRh /var/log/')
+
+        if journal and self.is_installed("systemd"):
+            if self.get_option("all_logs"):
+                since = ""
+            else:
+                since = "-%ddays" % days
+            self.add_journal(since=since)
         else:
-            self.add_copy_spec("/var/log/")
+            if not self.get_option("all_logs"):
+                self.add_copy_spec([
+                    "/var/log/syslog",
+                    "/var/log/syslog.1",
+                    "/var/log/kern.log",
+                    "/var/log/kern.log.1",
+                    "/var/log/auth.log",
+                    "/var/log/auth.log.1",
+                ])
+            else:
+                self.add_copy_spec([
+                    "/var/log/syslog*",
+                    "/var/log/kern.log*",
+                    "/var/log/auth.log*",
+                ])
 
 # vim: set et ts=4 sw=4 :